[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Carlos O'Donell]

On 11/13/25 4:25 AM, Yury Khrustalev wrote:
> On Wed, Nov 12, 2025 at 03:53:08PM -0500, Carlos O'Donell wrote:
>> On 11/12/25 2:08 PM, Joseph Myers wrote:
>>> On Wed, 12 Nov 2025, Carlos O'Donell wrote:
>>>
>>>> I don't object, but I'm just calling out that what we would really like
>>>> in this scenario is a mechanism for attesting that these downloaded
>>>> tarballs are actually what we expect e.g. sigstore etc.
>>>>
>>>> I wonder if we can't get a light-weight cross check?
>>>>
>>>> (1) Download the 310 byte signature from ftp.gnu.org.
>>>> (2) Cross check the signature validates for ftpmirror.gnu.org
>>>>
>>>> Thoughts?
>>>
>>> How about hardcoding an SHA256 (for example) checksum alongside the
>>> version number for everything where we use a tarball, and making the
>>> script check that?  That seems a fairly common approach for systems that
>>> download a tarball and expect it to have particular contents.  (We'd need
>>> to work out what to do when a user overrides the version number for such a
>>> component on the command line.)
>>
>> That works for me.
> 
> I like the idea of hard-coding checksums, however updating logic around
> overriding versions via command line goes beyond what I can do right
> now, so I'll have to keep this change downstream.

Please keep in mind that this was not a blocking request.

I'm happy to approve your patches as-is.

-- 
Cheers,
Carlos.